feat(network): implement ingress network policies #1017
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
Author
|
/build_test |
Member
Author
|
|
Member
Author
|
/build_test |
|
|
14 tasks
ebaron
reviewed
Jan 20, 2025
| }, | ||
| Ports: []networkingv1.NetworkPolicyPort{ | ||
| networkingv1.NetworkPolicyPort{ | ||
| Port: &intstr.IntOrString{IntVal: constants.AuthProxyHttpContainerPort}, |
Member
There was a problem hiding this comment.
Do we need a policy for the agent gateway (nginx) port as well? This could theoretically be limited to inbound traffic from the target namespaces of the CR
Member
Author
There was a problem hiding this comment.
Makes sense, I'll add that in
7 tasks
ebaron
approved these changes
Jan 21, 2025
Member
ebaron
left a comment
ebaron
left a comment
There was a problem hiding this comment.
Seems to work well. I added a commit with a couple of changes:
- Delete the NetworkPolicy object when the
disabledproperty is true - Update the NetworkPolicy spec by placing it in the body of the
CreateOrUpdate...method
What do you think?
Member
|
/build_test |
|
|
Member
Author
Nice, thanks. That looks good. |
7 tasks
7 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Welcome to Cryostat! 👋
Before contributing, make sure you have:
mainbranch[chore, ci, docs, feat, fix, test]git commit -S -m "YOUR_COMMIT_MESSAGE"Fixes: #1008
See #814
See also cryostatio/cryostat-helm#208
Description of the change:
Mirrors the
NetworkPolicyimplementation for ingress traffic from the Helm PR above.Motivation for the change:
Adds network-level isolation to various Pods created by the Operator, so that traffic to each is only allowed from expected origins (assuming the cluster supports this feature). This prevents unexpected connections to the database or storage, which could result in data being leaked if authentication is not configured or is somehow bypassed.
How to manually test:
oc describe networkpolicyoc runand try tocurlrequests tohttp://cryostat-sample-reports:10000orhttp://cryostat-sample-storage:8333.